661
NPM package compromised by author: erases files on RU / BY computers on install
Vue.js users using the dependency “node-ipc” are experiencing a supply chain attack protesting the invasion of Ukraine, from a package named “peacenotwar”.
Most cited
Posts that commenters keep linking to, ranked by how many different people have cited them in Hacker News comments. 1,584 posts.
662
663
ProtonMail Voluntarily Offers Assistance for Real-Time Surveillance?
Proton Mail disputed some of the content of the post originally published at this location. We will continue the discussion directly with Proton Mail, in particular at a meeting in …
664
665
So Your Startup Received the Nightmare GDPR Letter
Some dumb lawyer figured it would be fun to give GDPR trolls a form letter to use to inflict maximum damage on unsuspecting companies. The reason why this is dumb is simple: the GDPR serves a legitimate need but by decreasing the signal:noise ratio handcrafted requests from users with a legitimate concern can get…
666
Playing chicken with cat.jpg
I was reminded of this by 37signals' response on Monday to last week's cat.jpg privacy failure . To be clear, I have a lot of sympathy for 37signals: Once someone looked in their logs and saw "cat.jpg" as the name of the one hundred millionth file they had stored, I'm sure the resulting fit of laughter significantly…
667
Why (blank) gets you root
tracking down the cause of a serious authentication flaw
668
669
670
SSH Agent Restriction (new in OpenSSH 8.9)
OpenSSH agent restriction
671
672
The Most Backdoor-Looking Bug I’ve Ever Seen
This is the story of a bug that was discovered and fixed in Telegram’s self-rolled cryptographic protocol about seven years ago. The bug didn’t get any press, and no one seems to know about it, probably because it was only published in Russian.
673
Rust in the Android Platform
Posted by Jeff Vander Stoep and Stephen Hines, Android Team Correctness of code in the Android platform is a top priority for the securit...
674
A Tale of Two Pwnies (Part 1)
Just over two months ago, Chrome sponsored the Pwnium browser hacking competition. We had two fantastic submissions , and successfully bloc...
675
7-Zip: Multiple Memory Corruptions via RAR and ZIP
Blog about anti-virus software vulnerabilities.
676
OpenSSH 10.6p2 Critical workaround for alpine without PAM
OpenSSH release notes
677
678
Whose Computer Is It?
Patrick Wardle highlighted a tweet by Maxwell (" Some Apple apps bypass some network extensions and VPN Apps. Maps for example can directly access the internet bypassing any NEFilterDataProvider or NEAppProxyProviders you have running "), sparking an extensive HN discussion on Apple's ham-fisted tactics (not unlike…
679
680
Important Notice Regarding Public Availability of Stable Patches
grsecurity is the only drop-in Linux kernel replacement offering high-performance, state-of-the-art exploit prevention against both known and unknown threats.
681
Privacy preserving attribution for advertising
Advertising provides critical support for the Web. We’ve been looking to apply privacy preserving advertising technology to the attribution problem, so t
682
Updating our inactive account policies
Starting later this year, we are updating our inactivity policy for Google Accounts to 2 years across our products.
683
Combating abuse in Matrix – without backdoors
Matrix, the open protocol for secure decentralised communications
684
Why can't Apple decrypt your iPhone?
Last week I wrote about Apple’s new default encryption policy for iOS 8. Since that piece was intended for general audiences I mostly avoided technical detail. But since some folks (and appar…
685
Australian PM Calls for End-To-End Encryption Ban
"The laws of mathematics are very commendable but the only law that applies in Australia is the law of Australia", said Australian Prime Minister Malcolm Turnbull today. He has been rightly mocked for this nonsense claim, that foreshadows moves to require online messaging providers to provide law...
686
A High-Level Technical Overview of Homomorphic Encryption
About two years ago, I switched teams at Google to focus on fully homomorphic encryption (abbreviated FHE, or sometimes HE). Since then I’ve got to work on a lot of interesting projects, learning along the way about post-quantum cryptography, compiler design, and the ins and outs of fully homomorphic encryption. If…
687
Entropic Engineering DEFCON 32 Statement
Entropic Engineering was approached in January ‘24 by the DEFCON Badge Team, who were looking for a small company to partner with. They expressed that they specifically wanted to work with us as a woman-owned, queer- and POC-driven engineering firm to develop an electronic badge with a gaming element for this year’s…
688
How Cops Are Using Flock's ALPR Network to Surveil Protesters and Activists
Through an analysis of 10 months of nationwide searches on Flock Safety's servers, we discovered that more than 50 federal, state, and local agencies ran hundreds of searches through Flock's national network of surveillance data in connection with protest activity. In some cases, law enforcement specifically targeted…
689
New Tools for Detecting HTTPS Interception
The practice of HTTPS interception continues to be commonplace on the Internet. This blog post discusses types of monster-in-the-middle devices and software, and how to detect them.
690